Privacy

General information about the processing of your data

We are obliged by law to inform you about the processing of your personal data (hereinafter referred to as data) when you use our website. We take the protection of your personal data very seriously. This privacy statement informs you about the details of the processing of your data and about your legal rights in this regard. For terms such as “personal data” and “processing”, the legal definitions pursuant to Art. 4 GDPR apply. We reserve the right to adapt the privacy statement with future effect, in particular in the event of further development of the website, the use of new technologies or changes to the legal bases or the corresponding case law. We recommend that you read this privacy statement from time to time and take a printout or a copy for your records.

Scope

This privacy statement applies to all pages of https://vcc.hhl.de/. It does not cover any linked websites of other providers.

Controller

The following party is known as the controller under data protection law and therefore responsible for the processing of personal data within the scope of this privacy statement:

HHL gGmbH

Jahnallee 59, 04109 Leipzig

Phone: +49 341 9851-60

Email: info@hhl.de

Questions about data protection

If you have any questions about data protection with regard to our company or our website, you can contact our data protection officer:

MGID

Mitteldeutsche Gesellschaft für Informationssicherheit und Datenschutz mbH

Lars Nöcker

Mozartstraße 10, 04107 Leipzig

Phone: +49 341 96273553

email: datenschutz@hhl.de

Security

We have taken comprehensive technical and organizational precautions to protect your personal data from unauthorized access, abuse, loss and other external disruption. To this end, we regularly review our security measures and adapt them to the latest standards.

Your rights

You have the following rights with regard to the personal data concerning you that you can assert against us:

  • Right of access: You can request access to the personal data concerning you which we process, as set forth in Art. 15 GDPR.
  • Right to rectification: If the information concerning you is not (or no longer) correct, you can request its rectification in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed.
  • Right to erasure: You may request the erasure of your personal data in accordance with Art. 17 GDPR.
  • Right to restriction of processing: Pursuant to Art. 18 GDPR, you have the right to demand that the processing of your personal data be restricted.
  • Right to object to processing: Pursuant to Art. 21(1) GDPR, you have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data which occurs based on Art. 6(1) Sentence 1(e) or (f) GDPR. If you object, we will not process your data further, unless we can prove compelling legitimate reasons for the processing which override your interests, rights and freedoms or, moreover, the processing serves to establish and exercise or defend legal claims (Art. 21(1) GDPR). Furthermore, under Art. 21(2) GDPR you have the right to object at any time to the processing of your personal data for direct marketing purposes, which includes profiling to the extent that this is related to such direct marketing. In this privacy statement, we draw your attention to this right to object when describing each processing operation.
  • Right to withdraw your consent: If you have given your consent for processing, you have a right to withdraw that consent under Art. 7(3) GDPR.
  • Right to data portability: You have the right to receive the personal data you have given us in a structured, commonly used, machine-readable format (“data portability”) and the right to transfer this data to another controller, if the prerequisites of Art. 20(1)(a), (b) GDPR are fulfilled (Art. 20 GDPR).

You can assert your rights by informing us using the contact details specified under “Controller” above or by contacting the data protection officer designated by us.

If you believe that the processing of your personal data violates data protection law, then under Art. 77 GDPR you also have the right to lodge a complaint with a data protection supervisory authority of your choice. This also includes the data protection supervisory authority responsible for the controller: Saxon Commissioner for Data Protection, Postfach 110132, 01330 Dresden, +49351/85471 101, saechsdsb@slt.sachsen.de.

Using our website

In principle, you can use our website for purely informational purposes without disclosing your identity. When you access the individual pages of the website in this sense, this only results in access data being transferred to our web hosting service so that the website can be displayed to you. This involves the following data being processed:

  • Browser type/browser version
  • Operating system used
  • Language and version of the browser software
  • Date and time of access
  • Hostname of the accessing device
  • IP address
  • Content of the request (specific page)
  • Access status / HTTP status code
  • Websites accessed via the website
  • Referrer URL (website visited before)
  • Notification of whether the access was a success and
  • Volume of data transferred.

It is necessary for this data to be processed temporarily in order to make it technically possible for you to visit our website and deliver the website to your device. The access data is not used to identify individual users and is not combined with other data sources. The data is also stored in log files, in order to ensure the functionality of the website and the security of the information technology systems. The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR. We have legitimate interests in ensuring the functionality, integrity and security of the website. Storing access data in log files, in particular the IP address, for a longer period of time enables us to detect and prevent misuse. This includes, for example, defending against requests that would overload the service as well as against bots. The access data will be erased as soon as it is no longer required for achieving the purpose of its processing. In the case of recording the data to provide the website, this is the case when you end your visit to the website. The log data is generally stored directly and in such a way that it can only be accessed by administrators, and it is erased after ten days at the latest. After that, it is only indirectly available by reconstructing backups and is finally erased after a maximum of four weeks.

You may object to the processing. Your right of objection exists if you have reasons arising from your particular situation. You may send us your objection using the contact details specified under “Controller” above.

End device information

In addition to the access data mentioned above, technologies are used when using the website which store information in your terminal equipment (e.g. desktop PC, laptop, tablet and smartphone) or access information already stored in your terminal equipment. These technologies may be, for example, so-called cookies, pixels, LocalStorage, SessionStorage, IndexedDB or browser fingerprinting technologies. These technologies can be used to recognize you across devices and websites.

According to Section 25 (1) TTDSG, we generally require your consent for the use of these technologies. According to Section 25 (2) TTDSG, such consent is only not required if the technologies either enable the transmission of a message via a public telecommunications network or if they are absolutely necessary to provide a telemedia service expressly requested by you:

Technically necessary terminal device information

Some elements of our website serve the sole purpose of transmitting a message (Section 25 (2) No. 1 TTDSG) or are absolutely necessary to provide you with our website or individual functionalities of our website (Section 25 (2) No. 2 TTDSG). The elements will be deleted after the storage is no longer necessary.

You can prevent processing by making the appropriate settings in your browser software. For elements whose storage duration is not limited to the session, you can delete the elements in the settings of your browser software after your session has expired.

Contacting our company

When you contact our company, e.g. by email or using the contact form on the website, we will process the personal data you provide so that we can respond to your request. he legal basis for this processing is Art. 6(1) Sentence 1(f) GDPR and Art. 6(1) Sentence 1(b) GDPR, if the contact is made with the intention of concluding a contract. f the request is aimed at concluding a contract, it is necessary for you to provide your data in order to conclude a contract. If you do not provide your data, it will not be possible to conclude or execute a contract (in the form of establishing contact or processing the request). We delete the data accruing in this context after processing is no longer necessary – usually two years after the end of the communication – or, if necessary, restrict the processing to compliance with the existing legally mandatory retention obligations.

You may object to the processing. Your right of objection exists if you have reasons arising from your particular situation. You may send us your objection using the contact details specified under “Controller” above.

Processing for contractual purposes

We process your personal data if and to the extent necessary for the initiation, creation, execution and/or termination of a legal transaction with our company. The legal basis for this results from Art. 6(1) Sentence 1(b) GDPR. It is necessary for you to provide your data in order to conclude the contract and you are contractually obliged to provide your data. If you do not provide your data, it will not be possible to conclude and/or execute a contract. Once the purpose has been achieved (e.g. contract processing), the personal data will be blocked for further processing or erased, unless we are entitled to keep processing the data on the basis of a consent granted by you (e.g. consent to the processing of your email address for sending promotional emails), a contractual agreement, a statutory authorization (e.g. authorization to send direct marketing) or on the basis of justified interests (e.g. retention for asserting claims).

Your personal data will be passed on to third parties if

It is necessary for the creation, execution or termination of legal transactions with our company (e.g. when transmitting data to a payment service provider / a shipping company to process a contract with you) (Art. 6(1) Sentence 1(b) GDPR), or

A subcontractor or party we use to perform our obligations, which we use exclusively within the framework of providing the offers or services requested by you, needs this data (unless you are expressly informed otherwise, such auxiliary parties are only entitled to process the data insofar as this is necessary for the provision of the offer or service), or

There is an enforceable official order (Art. 6(1) Sentence 1(c) GDPR), or

There is an enforceable court order (Art. 6(1) Sentence 1(c) GDPR), or

We are legally obliged to do so (Art. 6(1) Sentence 1(c) GDPR), or

The processing is necessary in order to protect the vital interests of the data subject or another natural person (Art. 6(1) Sentence 1(d) GDPR), or

This is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (Art. 6(1) Sentence 1(e) GDPR), or

We can cite our overriding legitimate interests, or those of a third party, in the disclosure (Art. 6(1) Sentence 1(f) GDPR).

Your personal data will not be transmitted to other persons, companies or bodies unless you have effectively consented to such transmission. The legal basis for the processing is then Art. 6(1) Sentence 1(a) GDPR. In this privacy statement, we draw your attention to the respective recipients when describing each processing operation.

Integration of third-party content

The website integrates third-party content such as videos, maps and graphics from other websites. This integration always requires that the providers of this content (“third-party providers”) perceive the IP addresses of users. This is because without the IP address they would not be able to send the content to the browser of the respective user. As such, the IP address is required to display this content. In the following, we inform you about the services from external providers currently in use on our website, about the related processing in each case, and about how you can object or withdraw your consent.

YouTube videos

We use plug-ins of the video platform “YouTube.de” or “YouTube.com” on the website, a service of YouTube, LLC (headquarters at 901 Cherry Avenue, San Bruno, CA 94066, USA; hereinafter: “YouTube”), for which “Google” (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland and Google, LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA; hereinafter: “Google”) is the responsible party within the meaning of data protection law. By processing data through the plug-ins, we pursue the purpose of integrating visual content (“videos”) that we have published on “Youtube.de” or “Youtube.com” also on this website. While playing videos on our website, “YouTube” receives the information that you have accessed the corresponding sub-page of our website. In addition, some of the data mentioned in the section “Use of our website” is transmitted to “Google”. This occurs regardless of whether “YouTube” provides a user account through which you are logged in or whether no user account exists. If you are logged in to “Google”, your data will be directly assigned to your account. If you do not want the assignment with your profile at “YouTube”, you must log out before activating the button. “YouTube” stores your data as usage profiles and processes them independently of the existence of a user account with “Google” for purposes of advertising, market research and/or needs-based design of its website. With regard to the storage of and access to information in your terminal device, the legal basis is Section 25 (1) TTDSG; for further processing, the legal basis is Art. 6 (1) p. 1 lit. a) DSGVO. “Google” also processes the data in part in the USA. No adequacy decision of the EU Commission exists for a data transfer to the USA. So-called standard contractual clauses have been concluded with Google, LLC in order to commit Google, LLC to an adequate level of data protection. You can obtain a copy of the standard contractual clauses at https://cloud.google.com/terms/sccs

For more information on the purpose and scope of processing by “YouTube” and the storage period at “YouTube” or “Google”, please refer to the privacy policy of “Google” at https://policies.google.com/privacy

You may object to the processing. Your right of objection exists if you have reasons arising from your particular situation. You may send us your objection using the contact details specified under “Controller” above.

Copyright by Spirit Legal, March 2023